Professional Windows® PowerShell for Exchange Server 2007 Service Pack 1

Part III: Working with PowerShell in a Production Environment

414

If you had an application hang, but could not find it because you forgot the event id, you could query

the Application log to search all events and retrieve any event that had “ Hanging ” in the message. You

may be tempted to use the

Contains parameter but in doing so you must match the exact message.

Contains is similar to Equals . If you do not have the exact message you are searching for, place

wildcards in front of and behind the keywords you are searching for. The following query performs this

action and you can see Internet Explorer hang in the results of Figure 14 - 17 :

Get-EventLog -LogName Application | Where {$_.Message -like”Hanging*”} | fl

Figure 14-17

To retrieve all errors from the system log for a particular day, the cmdlet used in Figure 14 - 17 can be

modified to use

TimeGenerated and EntryType to specify the new search parameters. The LogName

value has also been switched from

Application to System . (See Figure 14 - 18 .)

Lastly, to export data from this cmdlet or from any cmdlet, pipeline the cmdlet to

export-csv and

specify the

.csv filename. The output is redirected to the .csv file and will not display on the screen.

From there, the

.csv file can be loaded into Excel or programmatically inserted in SQL through a DTS

package or via Service Broker.

Using Get - Messag